Storybook Dev Server is Vulnerable to WebSocket Hijacking

Description

The WebSocket functionality in Storybook’s dev server, used to create and update stories, is vulnerable to WebSocket hijacking. This vulnerability only affects the Storybook dev server; production builds are not impacted.

Recommendation

Update the storybook package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 10.0.0-beta.0, < 10.2.10

  >= 8.7.0-alpha.0, < 9.1.19

  >= 8.1.0, < 8.6.17**

• Patched version(s): **10.2.10

  9.1.19

  8.6.17**

References

• GHSA-mjf5-7g4m-gx5w
• CVE-2026-27148
• CWE-1385
• CWE-74
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Parse Server vulnerable to schema poisoning via prototype pollution in deep copy - CVE-2026-32878
• Parse Server's GraphQL WebSocket endpoint bypasses security middleware - CVE-2026-32594
• Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation - CVE-2026-2229
• Parse Server vulnerable to user enumeration via email verification endpoint - CVE-2026-31901

Tags:

npm

storybook